Merge 4.4.118 into android-4.4

Changes in 4.4.118
	net: add dst_cache support
	net: replace dst_cache ip6_tunnel implementation with the generic one
	cfg80211: check dev_set_name() return value
	mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
	xfrm: Fix stack-out-of-bounds read on socket policy lookup.
	xfrm: check id proto in validate_tmpl()
	blktrace: fix unlocked registration of tracepoints
	drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
	Provide a function to create a NUL-terminated string from unterminated data
	selinux: ensure the context is NUL terminated in security_context_to_sid_core()
	selinux: skip bounded transition processing if the policy isn't loaded
	crypto: x86/twofish-3way - Fix %rbp usage
	KVM: x86: fix escape of guest dr6 to the host
	netfilter: x_tables: fix int overflow in xt_alloc_table_info()
	netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
	netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
	netfilter: on sockopt() acquire sock lock only in the required scope
	netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
	net: avoid skb_warn_bad_offload on IS_ERR
	ASoC: ux500: add MODULE_LICENSE tag
	video: fbdev/mmp: add MODULE_LICENSE
	arm64: dts: add #cooling-cells to CPU nodes
	Make DST_CACHE a silent config option
	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
	staging: android: ashmem: Fix a race condition in pin ioctls
	binder: check for binder_thread allocation failure in binder_poll()
	staging: iio: adc: ad7192: fix external frequency setting
	usbip: keep usbip_device sockfd state in sync with tcp_socket
	usb: build drivers/usb/common/ when USB_SUPPORT is set
	ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
	ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
	ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
	ARM: dts: am4372: Correct the interrupts_properties of McASP
	perf top: Fix window dimensions change handling
	perf bench numa: Fixup discontiguous/sparse numa nodes
	media: s5k6aa: describe some function parameters
	pinctrl: sunxi: Fix A80 interrupt pin bank
	RDMA/cma: Make sure that PSN is not over max allowed
	scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
	ipvlan: Add the skb->mark as flow4's member to lookup route
	powerpc/perf: Fix oops when grouping different pmu events
	s390/dasd: prevent prefix I/O error
	gianfar: fix a flooded alignment reports because of padding issue.
	net_sched: red: Avoid devision by zero
	net_sched: red: Avoid illegal values
	btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
	509: fix printing uninitialized stack memory when OID is empty
	dmaengine: ioat: Fix error handling path
	dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
	clk: fix a panic error caused by accessing NULL pointer
	ASoC: rockchip: disable clock on error
	spi: sun4i: disable clocks in the remove function
	xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
	drm/armada: fix leak of crtc structure
	dmaengine: jz4740: disable/unprepare clk if probe fails
	mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
	x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
	xen: XEN_ACPI_PROCESSOR is Dom0-only
	hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
	virtio_balloon: prevent uninitialized variable use
	isdn: icn: remove a #warning
	vmxnet3: prevent building with 64K pages
	gpio: intel-mid: Fix build warning when !CONFIG_PM
	platform/x86: intel_mid_thermal: Fix suspend handlers unused warning
	video: fbdev: via: remove possibly unused variables
	scsi: advansys: fix build warning for PCI=n
	x86/ras/inject: Make it depend on X86_LOCAL_APIC=y
	arm64: define BUG() instruction without CONFIG_BUG
	x86/fpu/math-emu: Fix possible uninitialized variable use
	tools build: Add tools tree support for 'make -s'
	x86/build: Silence the build with "make -s"
	thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies
	x86: add MULTIUSER dependency for KVM
	x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG
	scsi: advansys: fix uninitialized data access
	arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
	ALSA: hda/ca0132 - fix possible NULL pointer use
	reiserfs: avoid a -Wmaybe-uninitialized warning
	ssb: mark ssb_bus_register as __maybe_unused
	thermal: spear: use __maybe_unused for PM functions
	x86/boot: Avoid warning for zero-filling .bss
	scsi: sim710: fix build warning
	drivers/net: fix eisa_driver probe section mismatch
	dpt_i2o: fix build warning
	profile: hide unused functions when !CONFIG_PROC_FS
	md: avoid warning for 32-bit sector_t
	mtd: ichxrom: maybe-uninitialized with gcc-4.9
	mtd: maps: add __init attribute
	mptfusion: hide unused seq_mpt_print_ioc_summary function
	scsi: fdomain: drop fdomain_pci_tbl when built-in
	video: fbdev: sis: remove unused variable
	staging: ste_rmi4: avoid unused function warnings
	fbdev: sis: enforce selection of at least one backend
	video: Use bool instead int pointer for get_opt_bool() argument
	scsi: mvumi: use __maybe_unused to hide pm functions
	SCSI: initio: remove duplicate module device table
	pwc: hide unused label
	usb: musb/ux500: remove duplicate check for dma_is_compatible
	tty: hvc_xen: hide xen_console_remove when unused
	target/user: Fix cast from pointer to phys_addr_t
	driver-core: use 'dev' argument in dev_dbg_ratelimited stub
	fbdev: auo_k190x: avoid unused function warnings
	amd-xgbe: Fix unused suspend handlers build warning
	mtd: sh_flctl: pass FIFO as physical address
	mtd: cfi: enforce valid geometry configuration
	fbdev: s6e8ax0: avoid unused function warnings
	modsign: hide openssl output in silent builds
	Drivers: hv: vmbus: fix build warning
	fbdev: sm712fb: avoid unused function warnings
	hwrng: exynos - use __maybe_unused to hide pm functions
	USB: cdc_subset: only build when one driver is enabled
	rtlwifi: fix gcc-6 indentation warning
	staging: wilc1000: fix kbuild test robot error
	x86/platform/olpc: Fix resume handler build warning
	netfilter: ipvs: avoid unused variable warnings
	ipv4: ipconfig: avoid unused ic_proto_used symbol
	tc1100-wmi: fix build warning when CONFIG_PM not enabled
	tlan: avoid unused label with PCI=n
	drm/vmwgfx: use *_32_bits() macros
	tty: cyclades: cyz_interrupt is only used for PCI
	genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msg
	ASoC: mediatek: add i2c dependency
	iio: adc: axp288: remove redundant duplicate const on axp288_adc_channels
	infiniband: cxgb4: use %pR format string for printing resources
	b2c2: flexcop: avoid unused function warnings
	i2c: remove __init from i2c_register_board_info()
	staging: unisys: visorinput depends on INPUT
	tc358743: fix register i2c_rd/wr functions
	drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized
	Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning
	KVM: add X86_LOCAL_APIC dependency
	go7007: add MEDIA_CAMERA_SUPPORT dependency
	em28xx: only use mt9v011 if camera support is enabled
	ISDN: eicon: reduce stack size of sig_ind function
	ASoC: rockchip: use __maybe_unused to hide st_irq_syscfg_resume
	serial: 8250_mid: fix broken DMA dependency
	drm/gma500: Sanity-check pipe index
	hdpvr: hide unused variable
	v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER
	cw1200: fix bogus maybe-uninitialized warning
	wireless: cw1200: use __maybe_unused to hide pm functions_
	perf/x86: Shut up false-positive -Wmaybe-uninitialized warning
	dmaengine: zx: fix build warning
	net: hp100: remove unnecessary #ifdefs
	gpio: xgene: mark PM functions as __maybe_unused
	ncpfs: fix unused variable warning
	Revert "power: bq27xxx_battery: Remove unneeded dependency in Kconfig"
	power: bq27xxx_battery: mark some symbols __maybe_unused
	isdn: sc: work around type mismatch warning
	binfmt_elf: compat: avoid unused function warning
	idle: i7300: add PCI dependency
	usb: phy: msm add regulator dependency
	ncr5380: shut up gcc indentation warning
	ARM: tegra: select USB_ULPI from EHCI rather than platform
	ASoC: Intel: Kconfig: fix build when ACPI is not enabled
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	dell-wmi, dell-laptop: depends DMI
	genksyms: Fix segfault with invalid declarations
	x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug
	drm/gma500: remove helper function
	kasan: rework Kconfig settings
	KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously
	x86/retpoline: Remove the esp/rsp thunk
	KVM: x86: Make indirect calls in emulator speculation safe
	KVM: VMX: Make indirect call speculation safe
	module/retpoline: Warn about missing retpoline in module
	x86/nospec: Fix header guards names
	x86/bugs: Drop one "mitigation" from dmesg
	x86/cpu/bugs: Make retpoline module warning conditional
	x86/spectre: Check CONFIG_RETPOLINE in command line parser
	Documentation: Document array_index_nospec
	array_index_nospec: Sanitize speculative array de-references
	x86: Implement array_index_mask_nospec
	x86: Introduce barrier_nospec
	x86/get_user: Use pointer masking to limit speculation
	x86/syscall: Sanitize syscall table de-references under speculation
	vfs, fdtable: Prevent bounds-check bypass via speculative execution
	nl80211: Sanitize array index in parse_txq_params
	x86/spectre: Report get_user mitigation for spectre_v1
	x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
	x86/paravirt: Remove 'noreplace-paravirt' cmdline option
	x86/kvm: Update spectre-v1 mitigation
	x86/retpoline: Avoid retpolines for built-in __init functions
	x86/spectre: Simplify spectre_v2 command line parsing
	x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
	KVM: nVMX: kmap() can't fail
	KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail
	kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
	KVM: VMX: clean up declaration of VPID/EPT invalidation types
	KVM: nVMX: invvpid handling improvements
	crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
	net: dst_cache_per_cpu_dst_set() can be static
	Linux 4.4.118

Change-Id: I01c76e1c15a611e13a1e98092bc5c01cdb5b6adb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 32 insertions, 8 deletions

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3900d34980de..f37f0c72b22a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2755,6 +2755,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 	kvm_x86_ops->vcpu_put(vcpu);
 	kvm_put_guest_fpu(vcpu);
 	vcpu->arch.last_host_tsc = rdtsc();
+	/*
+	 * If userspace has set any breakpoints or watchpoints, dr6 is restored
+	 * on every vmexit, but if not, we might have a stale dr6 from the
+	 * guest. do_debug expects dr6 to be cleared after it runs, do the same.
+	 */
+	set_debugreg(0, 6);
 }
 
 static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
@@ -8204,6 +8210,13 @@ static int apf_put_user(struct kvm_vcpu *vcpu, u32 val)
 				      sizeof(val));
 }
 
+static int apf_get_user(struct kvm_vcpu *vcpu, u32 *val)
+{
+
+	return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, val,
+				      sizeof(u32));
+}
+
 void kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu,
 				     struct kvm_async_pf *work)
 {
@@ -8230,6 +8243,7 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
 				 struct kvm_async_pf *work)
 {
 	struct x86_exception fault;
+	u32 val;
 
 	if (work->wakeup_all)
 		work->arch.token = ~0; /* broadcast wakeup */
@@ -8237,14 +8251,24 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
 		kvm_del_async_pf_gfn(vcpu, work->arch.gfn);
 	trace_kvm_async_pf_ready(work->arch.token, work->gva);
 
-	if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) &&
-	    !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
-		fault.vector = PF_VECTOR;
-		fault.error_code_valid = true;
-		fault.error_code = 0;
-		fault.nested_page_fault = false;
-		fault.address = work->arch.token;
-		kvm_inject_page_fault(vcpu, &fault);
+	if (vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED &&
+	    !apf_get_user(vcpu, &val)) {
+		if (val == KVM_PV_REASON_PAGE_NOT_PRESENT &&
+		    vcpu->arch.exception.pending &&
+		    vcpu->arch.exception.nr == PF_VECTOR &&
+		    !apf_put_user(vcpu, 0)) {
+			vcpu->arch.exception.pending = false;
+			vcpu->arch.exception.nr = 0;
+			vcpu->arch.exception.has_error_code = false;
+			vcpu->arch.exception.error_code = 0;
+		} else if (!apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) {
+			fault.vector = PF_VECTOR;
+			fault.error_code_valid = true;
+			fault.error_code = 0;
+			fault.nested_page_fault = false;
+			fault.address = work->arch.token;
+			kvm_inject_page_fault(vcpu, &fault);
+		}
 	}
 	vcpu->arch.apf.halted = false;
 	vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;